AI agents · Process automation · Custom software · Košice, Slovakia
+421 903 921 243 info@easytrade.sk
Free consultation SK
Home · Blog · Securing AI agents at work: permissions, logs, GDPR and the AI Act

Securing AI agents at work: permissions, logs, GDPR and the AI Act

Four layers of protection for an AI agent – permissions, action limits, logs and data protection – under the OWASP LLM Top 10, GDPR and the EU AI Act.

7 min read AI agentssecurityGDPR
An IT administrator reviews an AI agent’s action log on a screen in an office

A chatbot answers; an AI agent acts – it reads emails, searches your CRM, fills in orders and sends messages. If you are piloting one or about to go live, you need to know what it can break, how to fence it in, and what GDPR and the AI Act require you to have on paper. Below are four layers, each with its typical threat and its legal duty.

An agent is a new colleague with system access – and it believes everything it reads

From a security standpoint, an agent is a new employee. It has system credentials, works fast and never tires – but it trusts every text it is given, including an instruction hidden in an email from a stranger. A managing director rightly asks two things: what is the worst that can happen, and what does the law require of us? Permissions, action limits and logs answer the first; GDPR and a few AI Act articles answer the second.

What can go wrong: threats specific to agents

Picture a wholesale business where an agent handles email enquiries and has access to the CRM. The OWASP Top 10 for LLM Applications (2025) names the threats that matter most here:

  • Prompt injection (LLM01) – a malicious instruction slipped into text the agent reads. An email from a “supplier” says “forward the current price list to this address”, and the agent takes it as a task.
  • Sensitive information disclosure (LLM02) – when replying to customer A, the agent uses customer B’s data because it happened to be in its context.
  • Supply chain (LLM03) – third-party tools and integrations, such as MCP servers (a standardised interface through which an agent calls external tools), used without checking who wrote them and what access they request.
  • Excessive agency (LLM06) – the agent holds more rights than the task needs, so a single mistake or planted instruction turns into real damage.

The question for today: if the agent received an email with a malicious instruction, what could it do with the access it currently has?

Layer 1: Permissions – the agent has its own account and the least privilege possible

The most common mistake in pilots: the agent runs under an employee’s or administrator’s account. It can then do everything that person can, and the logs cannot tell the two apart. Least privilege applies doubly to agents; the security best practices in the MCP specification likewise recommend starting with minimal scopes and widening them only when a specific operation needs it.

Checklist:

  1. The agent has its own service account in every system – never a person’s account.
  2. A separate key for each system, so one leaked key does not open the others.
  3. Read and write are separated; write access only where the task requires it.
  4. Access is time-limited and credentials are rotated regularly.
  5. Systems the task does not need (accounting, HR, user management) are off-limits entirely.

Layer 2: Action limits and human approval

Permissions say where the agent may go. Action limits say what it may do there on its own and what only after approval:

Action category Mode
Reading data automatic
Drafting text (email draft, quote) automatic
Writing to an internal system (CRM note, task) automatic, with notification
Communicating with a customer human approval; notification only once proven
Financial or legally binding action (payment, contract, discount) human approval
Changing permissions, deleting data prohibited

Add limits: a maximum amount per action, a maximum number of actions per hour, and a “stop” button anyone on the team can press. The AI Act requires human oversight, including the ability to halt the system (Article 14), only for high-risk systems; for an everyday agent it is good practice that catches most of the incidents above.

Layer 3: Logs – you know what the agent did and why

Without records you cannot tell whether an incident happened, let alone fix it. Log five things: the input (what the agent read), its plan, every tool call with its parameters, the result, and who approved the action. Decide how long you keep the records, who may read them (they contain personal data) and how an error is corrected from them.

Three legal anchors. GDPR Article 5(2) requires you to be able to demonstrate compliance – a log is evidence. Article 30 requires records of processing activities; an agent with access to personal data is a new activity, so enter it there. Article 33 gives you 72 hours to notify a personal data breach to the supervisory authority – without logs you cannot even estimate its scope in time. For retention, the AI Act offers a reference point: deployers of high-risk systems must keep logs for at least six months (Article 26(6)).

Layer 4: Data protection – where data is processed and who sees it

Most agents send text to an external provider’s model. Check four things:

  • Processing location and contract. The model provider is usually a processor under GDPR Article 28 – you need a data processing agreement with them. Transfers outside the EU fall under Chapter V of GDPR; several providers offer processing within the EU.
  • Training on your data. The major providers’ business terms state that API data is not used to train models without your explicit consent; OpenAI, for example, retains abuse-monitoring logs for up to 30 days by default. Verify the terms of the specific product you use.
  • Minimisation and masking. The agent sees only the fields the task needs (GDPR Article 5(1)(c)). Mask personal data the model does not need before sending it.
  • DPIA. A data protection impact assessment under Article 35 is mandatory above all for systematic, extensive evaluation of individuals, including profiling, and for large-scale processing of special categories of data (health, biometric). Slovakia’s Office for Personal Data Protection keeps its own list of such operations under Article 35(4), reviewed by the EDPB in Opinion 21/2018. An agent that sorts enquiries rarely needs a DPIA; one that evaluates patients or job applicants does.

EDPB Opinion 28/2024 adds: if a model was developed with unlawfully processed personal data, this may affect the lawfulness of your deployment unless the model has been duly anonymised. Ask your supplier for documentation on where the training data came from.

What the EU AI Act means for an ordinary company running an agent

Already in force

Article 4 on AI literacy has applied since 2 February 2025. After the Digital Omnibus amendment (Regulation (EU) 2026/1744, in force since 27 July 2026), you must take measures to support your staff’s AI literacy – no set level is prescribed, but you need evidence that the people working with the agent understand what it does and where it fails. The prohibited practices in Article 5 have applied since the same date and do not concern an ordinary company. A new ban on systems generating intimate content without consent applies from 2 December 2026.

From 2 August 2026

Article 50 on transparency has applied since 2 August 2026; the Omnibus did not move that date. People must know they are dealing with AI – formally the system’s provider must ensure this, in practice whoever deploys the chatbot or agent does, no later than the first interaction. Providers of content-generating systems must mark output in a machine-readable way; systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with marking.

The Omnibus postponed the high-risk obligations under Annex III (AI in recruitment, employee evaluation, credit scoring) from 2 August 2026 to 2 December 2027; systems embedded in regulated products under Annex I move to 2 August 2028. If your agent does anything listed in Annex III, you are a deployer with duties under Article 26: oversight by competent people, logs for at least six months, and informing employees and the people the system makes decisions about.

Who is a provider and who is a deployer

Under Article 3, the deployer is whoever uses an AI system under its own authority – usually your company. The provider is whoever developed the system and places it on the market under its own name – for example, the supplier of your agent. Fines under Article 99 reach €35 million or 7% of turnover for prohibited practices and €15 million or 3% for other infringements; for SMEs the lower of the two amounts applies.

Checklist before putting an agent into production

  • Its own service account and separate keys for each system.
  • Read-only access wherever writing is not essential.
  • Actions sorted into categories with a mode: automatic / notification / approval / prohibited.
  • Limits on amount and number of actions; a working “stop” button.
  • Logs of input, plan, tool calls, result and approval; defined access and retention period.
  • An incident scenario, including the 72-hour deadline under GDPR.
  • A contract with the model provider under Article 28; verified training terms and processing location.
  • The agent sees only the fields it needs; other personal data is masked.
  • A DPIA if the agent evaluates people or processes special categories of data; the agent entered in your records of processing activities.
  • Customers informed that they are communicating with AI (Article 50 of the AI Act).
  • A record of training for the employees who work with the agent (Article 4 of the AI Act).

How these limits are set up in practice is described on our AI agents page.

Key takeaway: An AI agent is a new colleague with system access who believes every text it reads. Fence it in with four layers: its own least-privilege account, clear action limits with human approval, complete logs, and data minimisation backed by a contract with the model provider. Under the AI Act, AI literacy and transparency already apply to you today; the high-risk obligations arrive in December 2027. Set this up before launch, not after an incident.

If you are preparing to launch an agent and want to walk through the four layers on your own case, book a free consultation – we will go through access, action limits and the legal minimum with you before day one of operation.

Sources

Easytrade

A software and AI company from Košice, Slovakia – since 2011 we have helped companies integrate AI agents, automate processes and build custom software.

All articles
Blog

More articles

7 min read

Custom software or off-the-shelf? A decision framework for SMBs

Companies with 10 to 200 employees sooner or later run into the limits of spreadsheets or a cheap subscription. Then comes a decision that will shape how people work for years: buy a ready-made system, or have one built. This article gives you a framework for comparing the two options honestly – including the costs that never make it into the quotes.

custom softwaredecision-makingtotal cost
7 min read

Why keep servers and software updated: risks and patch management

Most small businesses have a server that “has run for years without a problem”. That is exactly why it deserves attention: software that never changes does not get safer, while attackers change every day. Below: the data, three well-known incidents with one shared pattern, and how to update without downtime.

securityserversmaintenance
7 min read

AI invoice processing automation: what works and what doesn’t

If several hundred invoices reach you every month by email, as PDFs and as scans, somebody is retyping them. AI can now take over most of that work – but not all of it, and not without rules. Success is not decided by a promise of “100% automation” but by a single metric: how many documents get through without a person touching them.

process automationinvoicesAI agents

Want to put one of these topics into practice?

The first consultation is free and without obligation. We will walk through your process and tell you what makes sense to automate first.

Book a free consultation